What happened
A vulnerability has been identified in OVHcloud mail servers, designated as CVE-2026-33586. The flaw allows authenticated users to manipulate the SMTP envelope “Envelope-from” and “From” fields when sending emails through affected systems. This vulnerability exploits the default SPF configuration employed by OVH; since many domains include the ‘include:mx.ovh.com’ directive, any authenticated user with an OVH email account can send messages that impersonate other OVH-hosted domains. These forged emails can successfully pass SPF validation due to the specific configuration, making it easier for malicious actors to impersonate trusted entities. Although this does not enable remote code execution or data theft, it can facilitate impersonation and spam campaigns, contributing to broader social engineering abuses.
Who is affected
The vulnerability affects organisations running OVHcloud mail servers using configurations prior to 20 July 2026. This includes any deployments where users are able to send email via OVH systems and have valid credentials. Since the flaw depends on the default SPF policy set by OVH, any affected environments sharing these configurations are at risk of email forgery. The threat primarily concerns entities concerned with email authenticity and domain reputation, especially where mail-based impersonation could impact trust or facilitate misinformation.
Recommended actions
- Review email sending practices to ensure proper validation of incoming messages and monitor for anomalies indicating impersonation.
- Implement alternative email authentication measures such as DKIM and DMARC where possible to help detect and prevent forged messages.
- Organisations should verify the configuration and scope of their SPF records, bearing in mind that the default setup includes ‘include:mx.ovh.com’, which may facilitate SPF validation of forged emails.
- Stay informed on updates from OVH regarding this vulnerability and any available patches or configuration adjustments that might mitigate the issue after their release.
